internal/appsec: request blocking based on user ID

[Hellzy]

What does this PR do?

This change adds a new SDK to the appsec top level package, SetUser(). SetUser() wraps the existing tracer.SetUser()
and performs a WAF call to check if the user ID passed to SetUser is on a block list, in which case an error is returned,
instructing the SDK user to block the request execution as soon as possible.

Additionally:

• A new remote configuration capability is added - ASMUserBlocking, and registered during remote config initialization by appsec
• TrackUserLoginSuccessEvent() now uses appsec.SetUser() and returns an error if the user should be blocked

Motivation

This is a planned feature.

Describe how to test/QA your changes

The change includes integration tests to test both the high level API usage (in the appsec package) and
the internal mechanics (internal/appsec), as well as the gRPC integration (contrib/google.golang.org/grpc).

Reviewer's Checklist

• If known, an appropriate milestone has been selected; otherwise the Triage milestone is set.
• Changed code has unit tests for its functionality.
• If this interacts with the agent in a new way, a system test has been added.

[pr-commenter]

Benchmarks

Comparing candidate commit 8595bb5 in PR branch francois.mazeau/user-blocking with baseline commit af63a73 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 6 cases.

[Hellzy]

Peer review comments

[Julio-Guerra]

This is a problem: we need to keep our dependency tree as lean as possible.
Here is an example of the resulting issue if not: an HTTP-only service will suddenly depend on gRPC (and all its sub-dependencies).

The reason why this is currently imported isn't valid as we discussed previously: the exact reason of the blocking will have to be split into separate sub-packages of this one (ie. public httpsec and grpcsec packages). But from now on, I suggest you to keep it simple and focused on our main goal here: returning an error without details means blocking.

[Julio-Guerra]

Side note: net/http is considered acceptable because it lives in the standard library.

[Hellzy]

956681d cleans this up. Everything is abstracted under the error interface and set within grpc/http dependant packages. I also changed the gRPC start operation to directly hold an error rather that a status code since status codes are communicated through errors anyway. The result is much cleaner and simpler - while we wait to refactor the actions system.